Code Red concerns prompt Rhode Island to shut down its Web sites

Code Red concerns prompt Rhode Island to shut down its Web sites

By Jason Miller

Aug 29, 2001

All the fear over the Code Red worm went for naught for most states in July.

With the widespread availability of a downloadable Microsoft Corp. patch, most state chief information officers were comfortable with just keeping technical personnel on standby. But at least one state was worried enough to turn off its Web pages overnight.

Rhode Island officials shut down all state Web sites for 12 hours July 31.

The virus, which reappeared at 8 p.m. EDT, attacked only computers running Microsoft Windows NT 4.0 or 2000 and Internet Information Server versions 4.0 or 5.0. More than 280,000 systems were infected when the virus first appeared July 19, said the CERT Coordination Center in Pittsburg at Carnegie Mellon University's Software Engineering Institute.

Rhode Island technical personnel installed the patches, but officials still believed there was enough risk to justify shuttering all state sites until 7 a.m. Aug. 1. In all, more than 60 sites went blank overnight.

No second thoughts

'The impression we got from our sources didn't give us enough confidence not to shut down our Web servers,' said Howard Boksenbaum, Rhode Island's chief technology officer. 'Our Web servers perform other functions, and we didn't want the worm to bring those functions down, too. We just didn't want to take any chances.'

Other states, such as Michigan and West Virginia, assigned technical staff to monitor the situation either from home or in the office in addition to installing the patch. Neither state's systems shops, however, considered shutting down Web sites.

'We made sure our computers were protected as best we could,' said George Boersma, Michigan's chief information officer. 'We spent a lot of time and effort over the past few weeks making sure we were prepared.'

Rhode Island, Michigan and West Virginia did not report any Code Red problems.

Boksenbaum added that this was the first time Rhode Island had shut down its sites, having never considered doing so before.

The last time any state turned off its Web sites was for the year 2000 rollover, said Thom Rubel, program director for state information technology at the National Governors Association.

'We don't have a lot of resources and don't have the staff to rebuild our sites if something happens,' Boksenbaum said. 'We would rather have been down for 12 hours than been down for who knows how long. We were conservative and cautious.'